Last week an agent tried to cheat a signed model through MCP-shaped tools and every attempt failed closed. This week the agent does not get a hand-wired model. It discovers one in the catalog: model/model.execute@1.0.0, the governed model capability published to the registry on October 15 (registry#639). We pulled that exact capability WASM, checked its digest against the catalog, and pointed it at a signed ONNX package of onnxmodelzoo/mnist-12. It ran on Browser, Node and Native with one fingerprint. Then the agent freestyled, and the model never ran.
model/model.execute@1.0.0 runs a signed ONNX package (exact-ref pin d820ea39…) on Browser, Node and Native. All 14 scenarios are byte-identical across the three hosts (fingerprint 12fea82f…c9d9), and the digits come back 7, 2, 1, 0. Every freestyle attempt fails closed the same way on every host. Everything is pinned to the published v0.15.0. The agent proposes; the runtime decides.
+ Public proof is this write-up and the screenshots. The runnable folder weekly-demos/2026-10-16-catalog-model-execute is for people who already have access (repo private). weekly-demos is still not publicly cloneable (.github#30).
+ Off the shelf, not hand-wired
+ +The catalog has 228 capabilities. model/model.execute@1.0.0 is one of them: an 8 KB WASM shim that takes an exact pin, a staged input, a model_usage declaration and a trust root, then asks the host's model connector to run exactly that package. The capability WASM sha256 (5ccfa372…4275) and contract sha256 (a96db38b…ef1c) are checked against the catalog entry on every host before anything runs.
The model came from the ONNX model zoo on Hugging Face (onnxmodelzoo/mnist-12). We packaged and signed it ourselves for the demo. The host runs the pinned package or nothing.
Same bytes on three hosts
+ +14 scenarios: 4 digits and 10 freestyle attempts. The capability's stdout JSON and the model's output frame are byte-identical on Browser (Chrome), Node and Native (wasmtime). Predictions are 7, 2, 1, 0, all correct, and the digit frames match the conformance vector.
+ +
+ 12fea82f…c9d9.The agent freestyles
+ +| Agent tries | Refused by | Reason, on every host |
|---|---|---|
Drops model_usage, or invents "research" | Capability WASM, before any host call | usage_undeclared |
| Sends an empty trust root | Capability WASM | key_untrusted |
| Trusts a signer it made up | Spec 138 host | key_untrusted |
| Swaps in another model digest, or asks for a bigger model under the same digest | Spec 138 host | pin_mismatch |
| One bit flipped in the ONNX weights | Spec 138 host | digest_mismatch |
| Host revokes the package | Spec 138 host | package_revoked |
| No connector bound | Runtime ABI (no ambient authority) | connector_unavailable |
In every one of those cases, the model never ran.
+ +
+ What is not true yet
+ +-
+
- The browser product path does not run it. Published
BundleEmbedder+runtime.wasmfails to instantiate the capability: theconnector_invokeimport is missing. Filed as traverse#1719.
+ - Browser and Node use demo glue. About 55 lines of labelled demo glue bind the connector to the published
ExactModelBrowserHostfromtraverse-embedder-web@0.15.0, which does the verify and execute.
+ - Native is the real product path. crates.io
traverse-runtime 0.15.0run_bytes_with_mediated_connectorsplus the crate's ownExactModelHostConnector, joined by a small host-written bridge.
+ - No production signing. The package is signed with a throwaway test key; only its public half is in the tree. Production key custody is traverse#1567. +
- Extra input fields are not rejected yet. The demo accepted an undeclared
promptfield on every host. Enforcement is #1671 on main, not in v0.15.0.
+
+ BundleEmbedder can't link connector_invoke yet.Facts for agents
+ +-
+
- Theme: An agent picks a model off the shelf. The contract still decides (week of 2026-10-16). +
- Public proof: this post and its screenshots. Runnable tree (access required, repo private): 2026-10-16-catalog-model-execute. Not a public clone — .github#30. +
- Capability: catalog
model/model.execute@1.0.0(registry#639). WASM5ccfa372…4275, contracta96db38b…ef1c, both equal to the catalog entry. Catalog size: 228 caps.
+ - Model: signed ONNX package of
onnxmodelzoo/mnist-12, exact-ref pind820ea39…. The model came from the ONNX model zoo on Hugging Face; nothing more is implied.
+ - Product pins: Traverse
v0.15.0. npmtraverse-embedder-web@0.15.0. cratestraverse-runtime/traverse-contracts0.15.0.
+ - Result: 14 scenarios byte-identical on Browser, Node and Native (fingerprint
12fea82f…c9d9). Predictions 7, 2, 1, 0.
+ - Freestyle:
usage_undeclared,key_untrusted,pin_mismatch,digest_mismatch,package_revoked,connector_unavailable, identical on every host; the model never runs.
+ - Hosts: Native (
traverse-runtimerun_bytes_with_mediated_connectors+ExactModelHostConnector) is the real product path. Browser and Node use about 55 lines of labelled demo glue overExactModelBrowserHost.
+ - Not claimed: browser
BundleEmbedder+runtime.wasmrunning it (missingconnector_invokeimport, traverse#1719). Production signing (test key; traverse#1567). Rejection of extra input fields (#1671, main only). Any Hugging Face partnership or integration.
+ - Lead claim: discover → execute → trace. The agent proposes; the runtime decides. +
The agent can pick from the shelf. It cannot pick what runs.
+ +